Malicious attack equipment identification method and device based on JA4 fingerprint characteristics

Abstract

The invention provides a malicious attack equipment identification method and device based on JA4 fingerprint characteristics, and relates to the technical field of network information security. The method comprises the following steps: firstly, acquiring an equipment fingerprint sample set of a malicious request and an equipment fingerprint sample set of a non-malicious request, then acquiring JA4 fingerprint features of each sample in the equipment fingerprint sample set of the malicious request and the equipment fingerprint sample set of the non-malicious request, and then training a hostile attack equipment identification model based on the JA4 fingerprint features of the samples to obtain a hostile attack equipment identification model; and finally, unknown fingerprint information is input into the trained hostile attack equipment identification model, and the equipment type of the equipment corresponding to the unknown fingerprint information is obtained. Therefore, the sample with the JA4 fingerprint feature is utilized to learn the hostile attack equipment identification model, and the unknown fingerprint information is input into the trained model to obtain the equipment type of the equipment corresponding to the unknown fingerprint information, so that the identification accuracy of the hostile attack equipment can be improved.

Description

Technical Field

[0001] The present application relates to the field of network information security technology, and in particular to a method and apparatus for identifying malicious attack devices based on JA4 fingerprint characteristics. Background Art

[0002] Network security protection equipment usually relies on the source IP of the IP protocol, the useragent of the HTTP protocol, sessionID and other identifiers to identify the attack source. Using proxy pools and cloud functions can hide the real source IP, and the useragent is easy to rewrite and forge. However, in the prior art, CD-HIT cluster analysis is performed using the original attribute information that constitutes JA3, which enables the identification of unfamiliar malicious TLS fingerprints, but this method is not accurate enough for identifying malicious attack devices.

[0003] In summary, how to improve the accuracy of identifying malicious attack devices is a problem that technical personnel in this field need to solve urgently. Summary of the invention

[0004] In view of this, the present application provides a method and apparatus for identifying malicious attack devices based on JA4 fingerprint characteristics, aiming to improve the accuracy of identifying malicious attack devices.

[0005] In a first aspect, the present application provides a method for identifying malicious attack devices based on JA4 fingerprint characteristics, including:

[0006] Obtain a device fingerprint sample set of malicious requests and a device fingerprint sample set of non-malicious requests;

[0007] Obtaining the JA4 fingerprint feature of each sample in the device fingerprint sample set of malicious requests and the device fingerprint sample set of non-malicious requests;

[0008] Based on the JA4 fingerprint feature of the sample, a malicious attack device identification model is trained to obtain a trained malicious attack device identification model;

[0009] The unknown fingerprint information is input into the trained malicious attack device identification model to obtain the device type of the device corresponding to the unknown fingerprint information; the device type is a malicious attack device or a non-malicious attack device.

[0010] Optionally, before obtaining the JA4 fingerprint feature of each sample in the device fingerprint sample set of malicious requests and the device fingerprint sample set of non-malicious requests, the method further includes:

[0011] In response to the outermost load balancing F5 performing certificate unloading, the JA4 fingerprint and the JA4 fingerprint feature are added to the request message.

[0012] Optionally, the training of a malicious attack device identification model based on the JA4 fingerprint feature of the sample to obtain a trained malicious attack device identification model includes:

[0013] Processing the JA4 fingerprint features of the sample to obtain the JA4 fingerprint attributes of the sample; the JA4 fingerprint attributes include protocol, TLS version number, SNI, the number of supported ciphers in the encryption suite, the number of extended attributes, ALPN in the extended attributes, encryption suite list, extended attribute list, and signature algorithm list;

[0014] The malicious attack device identification model is trained by using the JA4 fingerprint attribute of the sample to obtain the trained malicious attack device identification model.

[0015] Optionally, before the malicious attack device identification model is trained by using the JA4 fingerprint attribute of the sample to obtain the trained malicious attack device identification model, the method further includes:

[0016] Preprocessing the JA4 fingerprint attribute of the sample to obtain the preprocessed JA4 fingerprint attribute of the sample;

[0017] The using the JA4 fingerprint attribute of the sample to train the malicious attack device identification model to obtain the trained malicious attack device identification model includes:

[0018] The malicious attack device identification model is trained by using the JA4 fingerprint attribute of the preprocessed sample to obtain the trained malicious attack device identification model.

[0019] Optionally, the using the JA4 fingerprint attribute of the preprocessed sample to train the malicious attack device identification model to obtain the trained malicious attack device identification model includes:

[0020] Determining a preprocessed sample set according to the JA4 fingerprint attributes of the preprocessed samples;

[0021] The preprocessed sample set is sampled 1:1 according to the sample set type to obtain a sampling result; the sample set type is a device fingerprint sample set of malicious requests or a device fingerprint sample set of non-malicious requests.

[0022] The sampling results are divided into N groups using a bagging method to obtain N groups of data; N is an odd number less than 10;

[0023] Logistic regression is used to perform classification learning on the N groups of data.

[0024] Optionally, performing 1:1 sampling on the preprocessed sample set according to the sample set type to obtain a sampling result includes:

[0025] Setting a label for the preprocessed sample set according to the sample set type; the label is malicious or non-malicious;

[0026] The preprocessed sample set is sampled 1:1 according to the label to obtain a sampling result.

[0027] Optionally, preprocessing the JA4 fingerprint attribute of the sample to obtain the preprocessed JA4 fingerprint attribute of the sample includes:

[0028] Set the enumeration value t to 1, the enumeration value q to 0, the enumeration value d to 1, and the enumeration value i to 0, so that the enumeration attributes of the protocol and the SNI are converted into Boolean attributes; the enumeration values ​​of the protocol are t and q; the enumeration values ​​of the SNI are d and i;

[0029] Determine the values ​​of the integer attributes of the TLS version number, the number of ciphers supported in the cipher suite, and the number of extended attributes as enumerated values ​​of the TLS version number, the number of ciphers supported in the cipher suite, and the number of extended attributes, respectively;

[0030] Determine the TLS version number, the number of supported ciphers in the cipher suite, the value of the integer attribute of the number of extended attributes, the ALPN in the extended attributes, the cipher suite list, the extended attribute list, and the signature algorithm list as a set consisting of one or more enumeration values, respectively;

[0031] The set mechanical energy consisting of one or more enumeration values ​​is vectorized by one-hot encoding to obtain a Boolean type attribute after dimensionality increase.

[0032] In a second aspect, the present application provides a malicious attack device identification device based on JA4 fingerprint characteristics, comprising:

[0033] A first acquisition module is used to acquire a device fingerprint sample set of malicious requests and a device fingerprint sample set of non-malicious requests;

[0034] A second acquisition module is used to acquire the JA4 fingerprint feature of each sample in the device fingerprint sample set of malicious requests and the device fingerprint sample set of non-malicious requests;

[0035] A training module, used for training a malicious attack device identification model based on the JA4 fingerprint feature of the sample to obtain a trained malicious attack device identification model;

[0036] The identification module is used to input the unknown fingerprint information into the trained malicious attack device identification model to obtain the device type of the device corresponding to the unknown fingerprint information; the device type is a malicious attack device or a non-malicious attack device.

[0037] Optionally, the device further comprises:

[0038] An adding module is used for responding to the outermost load balancing F5 to perform certificate unloading and adding a JA4 fingerprint and the JA4 fingerprint feature in the request message.

[0039] Optionally, the training module includes:

[0040] A processing submodule, used to process the JA4 fingerprint features of the sample to obtain the JA4 fingerprint attributes of the sample; the JA4 fingerprint attributes include protocol, TLS version number, SNI, the number of supported ciphers in the encryption suite, the number of extended attributes, ALPN in the extended attributes, encryption suite list, extended attribute list and signature algorithm list;

[0041] The training submodule is used to train the malicious attack device identification model by using the JA4 fingerprint attribute of the sample to obtain the trained malicious attack device identification model.

[0042] Optionally, the device further comprises:

[0043] A preprocessing submodule, used to preprocess the JA4 fingerprint attribute of the sample to obtain the preprocessed JA4 fingerprint attribute of the sample;

[0044] The training submodule comprises:

[0045] The training unit is used to train the malicious attack device identification model by using the JA4 fingerprint attribute of the preprocessed sample to obtain the trained malicious attack device identification model.

[0046] Optionally, the training unit includes:

[0047] A determination subunit, configured to determine a preprocessed sample set according to the JA4 fingerprint attributes of the preprocessed samples;

[0048] The sampling sub-unit is used to perform 1:1 sampling on the preprocessed sample set according to the sample set type to obtain a sampling result; the sample set type is a device fingerprint sample set for malicious requests or a device fingerprint sample set for non-malicious requests.

[0049] A grouping subunit, used for dividing the sampling results into N groups by using a bagging method to obtain N groups of data; wherein N is an odd number less than 10;

[0050] The classification learning subunit is used to perform classification learning on the N groups of data using logistic regression.

[0051] Optionally, the sampling subunit is specifically used for:

[0052] Setting a label for the preprocessed sample set according to the sample set type; the label is malicious or non-malicious;

[0053] The preprocessed sample set is sampled 1:1 according to the label to obtain a sampling result.

[0054] Optionally, the preprocessing submodule includes:

[0055] a setting unit, configured to set an enumeration value t to 1, an enumeration value q to 0, an enumeration value d to 1, and an enumeration value i to 0, so that the enumeration attributes of the protocol and the SNI are converted into Boolean attributes; the enumeration values ​​of the protocol are t and q; the enumeration values ​​of the SNI are d and i;

[0056] A first determining unit, configured to determine the values ​​of the integer attributes of the TLS version number, the number of ciphers supported in the encryption suite, and the number of extended attributes as enumerated values ​​of the TLS version number, the number of ciphers supported in the encryption suite, and the number of extended attributes, respectively;

[0057] a second determining unit, configured to determine the TLS version number, the number of supported ciphers in the encryption suite, the value of the integer attribute of the number of extended attributes, the ALPN in the extended attributes, the encryption suite list, the extended attribute list, and the signature algorithm list as a set consisting of one enumeration value or a plurality of enumeration values, respectively;

[0058] The processing unit is used to vectorize the set mechanical energy consisting of one enumeration value or multiple enumeration values ​​by one-hot encoding to obtain a Boolean type attribute after dimensionality increase.

[0059] In a third aspect, an embodiment of the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements a malicious attack device identification method based on JA4 fingerprint characteristics as described in any one of the implementation methods in the first aspect of the embodiment of the present application.

[0060] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal device, the terminal device executes a malicious attack device identification method based on JA4 fingerprint characteristics as described in any one of the implementation methods in the first aspect of the embodiment of the present application.

[0061] The present application provides a method for identifying malicious attack devices based on JA4 fingerprint characteristics. When executing the method, first obtain a device fingerprint sample set of malicious requests and a device fingerprint sample set of non-malicious requests, then obtain the JA4 fingerprint features of each sample in the device fingerprint sample set of malicious requests and the device fingerprint sample set of non-malicious requests, then train the malicious attack device identification model based on the JA4 fingerprint features of the samples to obtain a trained malicious attack device identification model, and finally input the unknown fingerprint information into the trained malicious attack device identification model to obtain the device type of the device corresponding to the unknown fingerprint information. In this way, the malicious attack device identification model is learned using samples with JA4 fingerprint features, and the unknown fingerprint information is input into the trained malicious attack device identification model to obtain the device type of the device corresponding to the unknown fingerprint information, which can improve the accuracy of identifying malicious attack devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0063] Figure 1 A flowchart of a method for identifying a malicious attack device based on JA4 fingerprint characteristics provided in an embodiment of the present application;

[0064] Figure 2 A schematic diagram of the structure of a malicious attack device identification device based on JA4 fingerprint characteristics provided in an embodiment of the present application;

[0065] Figure 3 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. The present application provides a method and device for identifying malicious attack devices based on JA4 fingerprint characteristics, which are used in the field of network information security technology. The above is only an example and does not limit the application field of the method and device name provided by the present application.

[0067] Network security protection equipment usually relies on the source IP of the IP protocol, the useragent of the HTTP protocol, sessionID and other identifiers to identify the attack source. Using proxy pools and cloud functions can hide the real source IP, and the useragent is easy to rewrite and forge. However, in the prior art, CD-HIT cluster analysis is performed using the original attribute information that constitutes JA3, which enables the identification of unfamiliar malicious TLS fingerprints, but this method is not accurate enough for identifying malicious attack devices.

[0068] After research, the inventor proposed the technical solution of this application. First, a device fingerprint sample set of malicious requests and a device fingerprint sample set of non-malicious requests are obtained. Then, the JA4 fingerprint features of each sample in the device fingerprint sample set of malicious requests and the device fingerprint sample set of non-malicious requests are obtained. Then, based on the JA4 fingerprint features of the samples, a malicious attack device identification model is trained to obtain a trained malicious attack device identification model. Finally, the unknown fingerprint information is input into the trained malicious attack device identification model to obtain the device type of the device corresponding to the unknown fingerprint information. In this way, the malicious attack device identification model is learned using samples with JA4 fingerprint features, and the unknown fingerprint information is input into the trained malicious attack device identification model to obtain the device type of the device corresponding to the unknown fingerprint information, which can improve the accuracy of identifying malicious attack devices.

[0069] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. It should be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

[0070] See also Figure 1 , Figure 1 A flowchart of a method for identifying a malicious attack device based on JA4 fingerprint characteristics provided in an embodiment of the present application includes:

[0071] S101: Obtain a device fingerprint sample set of malicious requests and a device fingerprint sample set of non-malicious requests.

[0072] WAF is a web application firewall; Ngnix is ​​an inner load balancing device that can record all HTTP requests. The request traffic passing through WAF can be divided into interception traffic ReqB, alarm traffic ReqW and release traffic ReqA. Except for interception traffic ReqB, alarm traffic ReqW and release traffic ReqA are all released by WAF, but release traffic ReqA is usually not recorded by WAF because it is too large. The request released by WAF is recorded as ReqN on the inner load balancing device Ngnix. In this way, the device fingerprint sample set Df_m = f(ReqB) of malicious requests and the device fingerprint sample set Df_n = f(ReqA) = f(ReqN-ReqB) of non-malicious requests can be clearly distinguished.

[0073] S102: Obtain JA4 fingerprint features of each sample in a device fingerprint sample set of malicious requests and a device fingerprint sample set of non-malicious requests.

[0074] Before executing step S102, when F5 is performing certificate unloading, it is necessary to calculate the JA4 fingerprint and add JA4 (in the form of [JA4_a]_[JA4_b]_[JA4_c]) and JA4 fingerprint feature JA4_r (in the form of [JA4_a]_[cipherSuits]_[extensions]_[signatureAlgorithms]) to the request message header. Among them, F5 is the outermost load balancing and can perform HTTPS certificate unloading.

[0075] First, for each sample in the device fingerprint sample set of malicious requests and the device fingerprint sample set of non-malicious requests, obtain its JA4 fingerprint feature JA4_r, and pre-process the various components of the JA4 fingerprint feature JA4_r. The various components of the JA4 fingerprint feature JA4_r are as follows:

[0076] JA4_a can be divided into 6 attributes:

[0077] JA4_a1 = protocol, its enumeration value is "t" or "q";

[0078] JA4_a2 = TLS version number, which is a two-digit integer;

[0079] JA4_a3 = SNI, whose enumeration value is "d" or "i";

[0080] JA4_a4 = the number of ciphers supported in the encryption suite, which is a two-digit integer;

[0081] JA4_a5 = the number of extended attributes, which is a two-digit integer;

[0082] JA4_a6 = ALPN in the extended attributes, which is a string of two digits in length.

[0083] The cipher suite list [cipherSuits], the extended attribute list [extensions] and the signature algorithm list [signatureAlgorithms] are all sets consisting of multiple finite enumeration values.

[0084] Next, preprocess the above 9 attributes. The specific steps are as follows:

[0085] For the enumeration attributes JA4_a1=protocol and JA4_a3=SNI, set the enumeration value t to 1, the enumeration value q to 0, the enumeration value d to 1, and the enumeration value i to 0 to convert the enumeration attributes of JA4_a1=protocol and JA4_a3=SNI into Boolean attributes.

[0086] For the integer attributes JA4_a2 = TLS version number, JA4_a4 = the number of supported ciphers in the encryption suite, and JA4_a5 = the number of extended attributes, since the distance of the values ​​will interfere with the correlation of the results, and the value range of these three values ​​must not be greater than 99, their integer attributes are treated as enumeration attributes.

[0087] For the two-bit string JA4_a6=ALPN in the extended attribute, combined with the JA4 official algorithm and real data in the production environment, it is approximately composed of a limited number of enumeration values ​​such as "h2", "00", "h1", "sp", "ht", "h3", etc., and is treated the same as [cipherSuits], [extensions], and [signatureAlgorithms]. The enumeration space range of [cipherSuits] is within 350, the enumeration space range of [extensions] is 22, and the enumeration space range of [signatureAlgorithms] is within 300. The ranges of the above attributes observed in actual network traffic are all less than 40.

[0088] For JA4_a2 = TLS version number, JA4_a4 = the number of supported ciphers in the encryption suite, JA4_a5 = the number of extended attributes, JA4_a6 = ALPN in the extended attributes, [cipherSuits], [extensions] and [signatureAlgorithms], they are respectively regarded as a set of one enumeration value or multiple enumeration values, and are vectorized by one-hot encoding to obtain the Boolean type attributes after dimensionality increase.

[0089] S103: Based on the JA4 fingerprint feature of the sample, a malicious attack device identification model is trained to obtain a trained malicious attack device identification model.

[0090] According to the JA4 fingerprint attribute of the preprocessed sample, a preprocessed sample set is obtained, and the sample set is a device fingerprint sample set of malicious requests or a device fingerprint sample set of non-malicious requests. The preprocessed sample set is sampled 1:1 according to the sample set type to obtain a sampling result. Specifically, a label can be set for the preprocessed sample set according to the sample set type, and the label is malicious or non-malicious. The preprocessed sample set is sampled 1:1 according to the label to obtain a sampling result.

[0091] Next, the sampling results are divided into N groups using a bagging method to obtain N groups of data, where N is an odd number less than 10. Logistic regression is used to perform classification learning on the N groups of data to train the malicious attack device identification model to obtain a trained malicious attack device identification model.

[0092] S104: Input the unknown fingerprint information into the trained malicious attack device identification model to obtain the device type of the device corresponding to the unknown fingerprint information.

[0093] The unknown fingerprint information is input into the trained malicious attack device identification model, and the device type of the device corresponding to the unknown fingerprint information is output, which is a malicious attack device or a non-malicious attack device, thereby realizing the identification of the malicious attack device.

[0094] In the embodiment provided by the present application, a device fingerprint sample set of malicious requests and a device fingerprint sample set of non-malicious requests are first obtained, and then the JA4 fingerprint features of each sample in the device fingerprint sample set of malicious requests and the device fingerprint sample set of non-malicious requests are obtained. Then, based on the JA4 fingerprint features of the samples, a malicious attack device identification model is trained to obtain a trained malicious attack device identification model, and finally, the unknown fingerprint information is input into the trained malicious attack device identification model to obtain the device type of the device corresponding to the unknown fingerprint information. In this way, the malicious attack device identification model is learned using samples with JA4 fingerprint features, and the unknown fingerprint information is input into the trained malicious attack device identification model to obtain the device type of the device corresponding to the unknown fingerprint information, which can improve the accuracy of identifying malicious attack devices.

[0095] The above is some specific implementation of the malicious attack device identification method based on JA4 fingerprint characteristics provided by the embodiment of the present application. Based on this, the present application also provides a corresponding device. The device provided by the embodiment of the present application will be introduced from the perspective of functional modularization.

[0096] See also Figure 2 , Figure 2A schematic diagram of a malicious attack device identification device based on JA4 fingerprint characteristics provided in an embodiment of the present application, the malicious attack device identification device 200 based on JA4 fingerprint characteristics includes:

[0097] A first acquisition module 210 is used to acquire a device fingerprint sample set of malicious requests and a device fingerprint sample set of non-malicious requests;

[0098] A second acquisition module 220 is used to acquire the JA4 fingerprint feature of each sample in the device fingerprint sample set of malicious requests and the device fingerprint sample set of non-malicious requests;

[0099] A training module 230, configured to train a malicious attack device identification model based on the JA4 fingerprint feature of the sample to obtain a trained malicious attack device identification model;

[0100] The identification module 240 is used to input the unknown fingerprint information into the trained malicious attack device identification model to obtain the device type of the device corresponding to the unknown fingerprint information; the device type is a malicious attack device or a non-malicious attack device.

[0101] Optionally, the device 200 further includes:

[0102] An adding module is used for responding to the outermost load balancing F5 to perform certificate unloading and adding the JA4 fingerprint and the JA4 fingerprint feature in the request message.

[0103] Optionally, the training module 230 includes:

[0104] A processing submodule, used to process the JA4 fingerprint features of the sample to obtain the JA4 fingerprint attributes of the sample; the JA4 fingerprint attributes include protocol, TLS version number, SNI, the number of supported ciphers in the encryption suite, the number of extended attributes, ALPN in the extended attributes, encryption suite list, extended attribute list and signature algorithm list;

[0105] The training submodule is used to train the malicious attack device identification model by using the JA4 fingerprint attribute of the sample to obtain the trained malicious attack device identification model.

[0106] Optionally, the device 200 further includes:

[0107] A preprocessing submodule, used to preprocess the JA4 fingerprint attribute of the sample to obtain the preprocessed JA4 fingerprint attribute of the sample;

[0108] The training submodule comprises:

[0109] The training unit is used to train the malicious attack device identification model by using the JA4 fingerprint attribute of the preprocessed sample to obtain the trained malicious attack device identification model.

[0110] Optionally, the training unit includes:

[0111] A determination subunit, configured to determine a preprocessed sample set according to the JA4 fingerprint attributes of the preprocessed samples;

[0112] The sampling sub-unit is used to perform 1:1 sampling on the preprocessed sample set according to the sample set type to obtain a sampling result; the sample set type is a device fingerprint sample set for malicious requests or a device fingerprint sample set for non-malicious requests.

[0113] A grouping subunit, used for dividing the sampling results into N groups by using a bagging method to obtain N groups of data; wherein N is an odd number less than 10;

[0114] The classification learning subunit is used to perform classification learning on the N groups of data using logistic regression.

[0115] Optionally, the sampling subunit is specifically used for:

[0116] Setting a label for the preprocessed sample set according to the sample set type; the label is malicious or non-malicious;

[0117] The preprocessed sample set is sampled 1:1 according to the label to obtain a sampling result.

[0118] Optionally, the preprocessing submodule includes:

[0119] a setting unit, configured to set an enumeration value t to 1, an enumeration value q to 0, an enumeration value d to 1, and an enumeration value i to 0, so that the enumeration attributes of the protocol and the SNI are converted into Boolean attributes; the enumeration values ​​of the protocol are t and q; the enumeration values ​​of the SNI are d and i;

[0120] A first determining unit, configured to determine the values ​​of the integer attributes of the TLS version number, the number of ciphers supported in the encryption suite, and the number of extended attributes as enumerated values ​​of the TLS version number, the number of ciphers supported in the encryption suite, and the number of extended attributes, respectively;

[0121] a second determining unit, configured to determine the TLS version number, the number of supported ciphers in the encryption suite, the value of the integer attribute of the number of extended attributes, the ALPN in the extended attributes, the encryption suite list, the extended attribute list, and the signature algorithm list as a set consisting of one enumeration value or a plurality of enumeration values, respectively;

[0122] The processing unit is used to vectorize the set mechanical energy consisting of one enumeration value or multiple enumeration values ​​by one-hot encoding to obtain a Boolean type attribute after dimensionality increase.

[0123] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.

[0124] like Figure 3 As shown, the computer device 01 is in the form of a general computing device. The components of the computer device 01 may include but are not limited to: one or more processors or processing units 03, a system memory 08, and a bus 04 connecting different system components (including the system memory 08 and the processing unit 03).

[0125] Bus 04 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor or a local bus using any of a variety of bus structures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0126] The computer device 01 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 01, including volatile and non-volatile media, removable and non-removable media.

[0127] The system memory 08 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 09 and / or cache memory 10. The computer device 01 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 11 may be used to read and write non-removable, non-volatile magnetic media ( Figure 3 not shown, usually called a "hard drive"). Although Figure 3 Not shown in the figure, a disk drive for reading and writing a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 04 via one or more data medium interfaces. The memory 08 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0128] A program / utility 12 having a set (at least one) of program modules 13 may be stored, for example, in the memory 08, such program modules 13 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination thereof may include an implementation of a network environment. The program modules 13 generally perform the functions and / or methods of the embodiments described herein.

[0129] The computer device 01 may also communicate with one or more external devices 02 (e.g., keyboard, pointing device, display 07, etc.), one or more devices that enable a user to interact with the computer device 01, and / or any device that enables the computer device 01 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed via input / output (I / O) interface 06. Furthermore, the computer device 01 may also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) via network adapter 05. Figure 3 As shown, the network adapter 05 communicates with other modules of the computer device 01 via the bus 04. It should be understood that although Figure 3 Not shown, other hardware and / or software modules may be used in conjunction with computer device 01, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0130] The processor unit 03 executes various functional applications and data processing by running programs stored in the system memory 08, for example, implementing a malicious attack device identification method based on JA4 fingerprint characteristics provided in an embodiment of the present application.

[0131] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0132] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0133] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work. The above is only an exemplary implementation of the present application and is not intended to limit the scope of protection of the present application.

Claims

1. A method for identifying malicious attack devices based on JA4 fingerprint characteristics, characterized in that: include: Obtain a device fingerprint sample set of malicious requests and a device fingerprint sample set of non-malicious requests; Obtaining the JA4 fingerprint feature of each sample in the device fingerprint sample set of malicious requests and the device fingerprint sample set of non-malicious requests; Based on the JA4 fingerprint feature of the sample, a malicious attack device identification model is trained to obtain a trained malicious attack device identification model; The unknown fingerprint information is input into the trained malicious attack device identification model to obtain the device type of the device corresponding to the unknown fingerprint information; the device type is a malicious attack device or a non-malicious attack device.

2. The method according to claim 1, characterized in that Before obtaining the JA4 fingerprint feature of each sample in the device fingerprint sample set of malicious requests and the device fingerprint sample set of non-malicious requests, the method further includes: In response to the outermost load balancing F5 performing certificate unloading, the JA4 fingerprint and the JA4 fingerprint feature are added to the request message.

3. The method according to claim 1, characterized in that The malicious attack device identification model is trained based on the JA4 fingerprint feature of the sample to obtain a trained malicious attack device identification model, including: Processing the JA4 fingerprint features of the sample to obtain the JA4 fingerprint attributes of the sample; the JA4 fingerprint attributes include protocol, TLS version number, SNI, the number of supported ciphers in the encryption suite, the number of extended attributes, ALPN in the extended attributes, encryption suite list, extended attribute list, and signature algorithm list; The malicious attack device identification model is trained by using the JA4 fingerprint attribute of the sample to obtain the trained malicious attack device identification model.

4. The method according to claim 3, characterized in that Before the malicious attack device identification model is trained by using the JA4 fingerprint attribute of the sample to obtain the trained malicious attack device identification model, the method further includes: Preprocessing the JA4 fingerprint attribute of the sample to obtain the preprocessed JA4 fingerprint attribute of the sample; The using the JA4 fingerprint attribute of the sample to train the malicious attack device identification model to obtain the trained malicious attack device identification model includes: The malicious attack device identification model is trained by using the JA4 fingerprint attribute of the preprocessed sample to obtain the trained malicious attack device identification model.

5. The method according to claim 4, characterized in that The using the JA4 fingerprint attribute of the preprocessed sample to train the malicious attack device identification model to obtain the trained malicious attack device identification model includes: Determining a preprocessed sample set according to the JA4 fingerprint attributes of the preprocessed samples; The preprocessed sample set is sampled 1:1 according to the sample set type to obtain a sampling result; the sample set type is a device fingerprint sample set of malicious requests or a device fingerprint sample set of non-malicious requests. The sampling results are divided into N groups using a bagging method to obtain N groups of data; N is an odd number less than 10; Logistic regression is used to perform classification learning on the N groups of data.

6. The method according to claim 5, characterized in that The performing 1:1 sampling on the preprocessed sample set according to the sample set type to obtain a sampling result includes: Setting a label for the preprocessed sample set according to the sample set type; the label is malicious or non-malicious; The preprocessed sample set is sampled 1:1 according to the label to obtain a sampling result.

7. The method according to claim 4, characterized in that The preprocessing of the JA4 fingerprint attribute of the sample to obtain the preprocessed JA4 fingerprint attribute of the sample includes: Set the enumeration value t to 1, the enumeration value q to 0, the enumeration value d to 1, and the enumeration value i to 0, so that the enumeration attributes of the protocol and the SNI are converted into Boolean attributes; the enumeration values ​​of the protocol are t and q; the enumeration values ​​of the SNI are d and i; Determine the values ​​of the integer attributes of the TLS version number, the number of ciphers supported in the cipher suite, and the number of extended attributes as enumerated values ​​of the TLS version number, the number of ciphers supported in the cipher suite, and the number of extended attributes, respectively; Determine the TLS version number, the number of supported ciphers in the cipher suite, the value of the integer attribute of the number of extended attributes, the ALPN in the extended attributes, the cipher suite list, the extended attribute list, and the signature algorithm list as a set consisting of one or more enumeration values, respectively; The set mechanical energy consisting of one or more enumeration values ​​is vectorized by one-hot encoding to obtain a Boolean type attribute after dimensionality increase.

8. A malicious attack device identification device based on JA4 fingerprint characteristics, characterized in that: include: A first acquisition module is used to acquire a device fingerprint sample set of malicious requests and a device fingerprint sample set of non-malicious requests; A second acquisition module is used to acquire the JA4 fingerprint feature of each sample in the device fingerprint sample set of malicious requests and the device fingerprint sample set of non-malicious requests; A training module, used for training a malicious attack device identification model based on the JA4 fingerprint feature of the sample to obtain a trained malicious attack device identification model; The identification module is used to input the unknown fingerprint information into the trained malicious attack device identification model to obtain the device type of the device corresponding to the unknown fingerprint information; the device type is a malicious attack device or a non-malicious attack device.

9. A computer device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for identifying a malicious attack device based on JA4 fingerprint characteristics as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on the terminal device, the terminal device executes the malicious attack device identification method based on JA4 fingerprint characteristics as described in any one of claims 1 to 7.

Images